Question

A risk practitioner reviews an enterprise's IT estate and finds that several core business applications still run on an unsupported operating system for which the vendor no longer issues security patches. IT operations continues to keep the systems running because migrating them would disrupt production. From a risk management perspective, what is the MOST significant concern the practitioner should raise to leadership?

Accepted Answer

The accumulated technical debt increases exposure to unpatched vulnerabilities that cannot be remediated, elevating the enterprise's risk profile beyond what may be within appetite

Answer

The applications should be immediately decommissioned regardless of business dependency to eliminate the vulnerability

Answer

IT operations lacks a service-level agreement with the operating system vendor for extended support

Answer

The help desk may receive more support tickets as the legacy systems age and degrade